Coder vulnerabilities

Products

• Coder 36
• Code-server 4

Newest

• coder Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication CVE-2026-118687 8.3 HighOctober 28, 2026
• coder Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header CVE-2026-111934 6.3 MediumOctober 17, 2026
• coder Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy CVE-2026-111931 5.3 MediumOctober 17, 2026
• coder Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint CVE-2026-111930 5.3 MediumOctober 17, 2026
• coder Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC CVE-2026-111929 6.0 MediumOctober 17, 2026
• coder Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy CVE-2026-111928 5.3 MediumOctober 17, 2026
• coder Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match CVE-2026-111927 8.7 HighOctober 17, 2026
• coder Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest CVE-2026-111926 4.8 MediumOctober 17, 2026
• coder Coder before 2.34.2 Stored HTML Injection via Appearance Settings CVE-2026-111932 Fix available 4.8 MediumAugust 20, 2026
• coder Coder before 2.34.2 User Enumeration via Login Placeholder Hash CVE-2026-111933 Fix available 6.3 MediumAugust 20, 2026
• coder Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write CVE-2026-63443 Fix available 8.3 HighJuly 6, 2026
• coder Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing CVE-2026-55438 Fix available 5.8 MediumJuly 6, 2026
• coder Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component CVE-2026-55437 Fix available 5.4 MediumJuly 6, 2026
• coder Coder's AI Bridge Proxy skips TLS certificate verification in default configuration CVE-2026-55436 Fix available 7.4 HighJuly 6, 2026
• coder Suspended Coder users retain access to AI Bridge LLM proxy endpoints CVE-2026-55435 Fix available 5.4 MediumJuly 6, 2026
• coder Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints CVE-2026-55434 Fix available 6.5 MediumJuly 6, 2026
• coder Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers CVE-2026-55433 Fix available 5.4 MediumJuly 6, 2026
• coder Coder's sub-agent app registration bypasses template port-sharing policy enforcement CVE-2026-55432 Fix available 5.4 MediumJuly 6, 2026
• coder Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps CVE-2026-55431 Fix available 7.7 HighJuly 6, 2026
• coder Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service CVE-2026-55078 Fix available 6.5 MediumJuly 6, 2026
• coder Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access CVE-2026-55430 Fix available 5.8 MediumJuly 6, 2026
• coder Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVE-2026-55428 Fix available 8.2 HighJuly 6, 2026
• coder Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVE-2026-55429 Fix available 8.7 HighJuly 6, 2026
• coder Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service CVE-2026-55079 Fix available 4.9 MediumJuly 6, 2026
• coder Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVE-2026-55427 Fix available 8.3 HighJuly 6, 2026
• coder Coder: User-admin role can reset owner account password CVE-2026-55077 Fix available 7.2 HighJuly 6, 2026
• coder Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass CVE-2026-55075 Fix available 7.4 HighJuly 6, 2026
• coder Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking CVE-2026-55076 Fix available 7.4 HighJuly 6, 2026
• coder Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVE-2026-44454 Fix available 8.1 HighJuly 2, 2026
• coder Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVE-2026-46354 Fix available 9.1 CriticalMay 19, 2026
• coder Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint CVE-2026-45796 Fix available 6.5 MediumMay 19, 2026
• coder code-marketplace Code Extension Marketplace has a Zip Slip Path Traversal CVE-2026-35454 Fix available 8.7 HighApril 4, 2026
• coder Coder logged sensitive objects unsanitized CVE-2025-66411 Fix available 7.8 HighDecember 3, 2025
• coder agentapi AgentAPI exposed user chat history via a DNS rebinding attack CVE-2025-59956 Fix available 6.5 MediumSeptember 29, 2025
• coder Coder's privilege escalation vulnerability could lead to a cross workspace compromise CVE-2025-58437 Fix available 8.1 HighSeptember 5, 2025
• coder Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token CVE-2025-71435 Fix available 2.3 LowAugust 28, 2025
• coder code-server code-server session cookie can be extracted by having user visit specially crafted proxy URL CVE-2025-47269 Fix available EPSS 56.3% 8.3 HighMay 9, 2025
• coder Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter CVE-2024-58398 Fix available 5.3 MediumOctober 28, 2024
• coder Coder's OIDC authentication allows email with partially matching domain to register CVE-2024-27918 Fix available 8.2 HighMarch 4, 2024
• coder code-server code-server vulnerable to Missing Origin Validation in WebSockets CVE-2023-26114 Fix available 8.2 HighMarch 23, 2023
• coder code-server Cross site scripting in code-server CVE-2021-42648 Fix available 6.1 MediumMay 11, 2022
• cdr cdr/code-server, coder code-server +1 more Inefficient Regular Expression Complexity in cdr/code-server CVE-2021-3810 Fix available 7.5 HighSeptember 17, 2021